VVBL

VVBL is a list of vulnerable “boxes”/virtual machines collected from different platforms, where their attack techniques, services, operating system, difficulty, platform, etc. are specified. If you want to know how to search, you can look at the help page.

Name	Properties	All Services/Software	Pentest Services/Software	Attacks/Techniques	Subtechniques (spoiler)
2much	easy vulnhub unix realistic free ubuntu	ssh http mysql apache express.js node.js db server	ssh http node.js	fuzzing backup/config/system/log file misconfiguration creds code-execution-injection hidden file docker escape/privesc	extension fuzzing stored creds log file docker escape node-js execution/injection
Academy	easy hackthebox unix realistic paid ubuntu	ssh http mysql apache laravel framework db server	ssh http mysql laravel framework db server	cve deserialization fuzzing backup/config/system/log file creds decode broken access control sudo/privesc	extension fuzzing stored creds php deserialization log file cookie/token/field manipulation CVE-2018-15133 hex decode sudo composer
Active	easy hackthebox windows realistic paid active directory osep-style	rpc ldap smb dns kerberos netbios ldaps	rpc smb kerberos netbios	cve backup/config/system/log file decrypt kerberos attack	gpp decrypt kerberoasting krb5tgs hash decrypt CVE-2014-1812
Admirer	easy hackthebox unix realistic paid debian	ssh http mysql ftp apache vsftpd db server adminer	ssh http mysql ftp db server adminer	fuzzing backup/config/system/log file creds rogue server sudo/privesc	extension fuzzing exposed credentials backup file sudo setenv sudo bash script mysql rogue server
Alfred	easy tryhackme windows realistic paid	http rdp iis jenkins	http jenkins	authenticated rce creds abuse privileges	default/common creds Jenkins RCE authenticated SeImpersonatePrivilege SeDebugPrivilege
All in One	easy tryhackme unix ctf free ubuntu	ssh http ftp apache wordpress cms vsftpd	http wordpress cms	authenticated rce fuzzing backup/config/system/log file creds decrypt permissions wp plugin exploit cron/scheduled tasks sudo/privesc inclusion/traversal	directory fuzzing lfi stored creds backup file cronjob insecure permissions vigenere decrypt WordPress RCE authenticated sudo socat Mail Masta WP plugin
AllSigns Point2Pwnage	medium tryhackme windows ctf/realistic paid	http rpc smb ftp netbios rdp apache vnc microsoft ftp TigerVNC	http smb ftp netbios vnc	file upload creds abuse privileges	stored creds file upload via smb SeImpersonatePrivilege
Anonforce	easy tryhackme unix ctf free ubuntu	ssh ftp vsftpd	ssh ftp	backup/config/system/log file decrypt	backup file sha512 hash decrypt gpg decrypt
Anonymous	easy tryhackme unix ctf free ubuntu	ssh smb ftp netbios vsftpd	ftp	file upload misconfiguration suid	file upload via ftp cronjob insecure permissions suid env
Anthem	easy tryhackme windows ctf free	http rpc smb winrm netbios rdp umbraco cms	http rdp	creds permissions hidden file	exposed credentials hidden file insecure permissions
Apocalyst	medium hackthebox unix ctf paid ubuntu	ssh http apache wordpress cms	http wordpress cms	authenticated rce fuzzing stego permissions	directory fuzzing insecure permissions WordPress RCE authenticated stego
Aragog	medium hackthebox unix ctf paid ubuntu	ssh http mysql ftp apache wordpress cms vsftpd db server	ssh http ftp wordpress cms	xxe fuzzing backup/config/system/log file creds capture hash/cred/email cron/scheduled tasks	extension fuzzing xxe config file cronjob capture credentials ssh_keys
Archangel	easy tryhackme unix ctf/realistic free ubuntu	ssh http apache	ssh http	fuzzing inspection permissions cron/scheduled tasks suid path hijacking inclusion/traversal	extension fuzzing lfi log poisoning source code inspection cronjob insecure permissions suid custom path hijacking
Arctic	easy hackthebox windows realistic paid	http rpc adobe coldfusion	http adobe coldfusion	authenticated rce cve kernel exploit abuse privileges inclusion/traversal	CVE-2010-2861 CVE-2009-2265 ColdFusion RCE authenticated SeImpersonatePrivilege CVE-2010-2554 MS10-059 directory traversal
Armageddon	easy hackthebox unix ctf/realistic paid ubuntu	ssh http apache drupal	ssh http drupal	cve creds db enumeration decrypt sudo/privesc	stored creds CVE-2018-7600 mysql enumeration drupal7 hash decrypt sudo snap
Atlas	easy tryhackme windows realistic free	http rdp vnc ThinVNC	http rdp vnc ThinVNC	cve creds	stored creds sam-decrypt PrintNightmare CVE-2021-1675 CVE-2021-34527
Attacktive Directory	medium tryhackme windows ctf/realistic free active directory osep-style	http rpc ldap smb dns kerberos winrm netbios rdp iis ldaps	smb kerberos netbios	backup/config/system/log file kerberos attack	ASREP Roasting krb5asrep hash decrypt dcsync
Badbyte	easy tryhackme unix ctf/realistic free ubuntu	ssh http mysql ftp wordpress cms vsftpd db server	ssh http ftp wordpress cms	cve creds wp plugin exploit routing inclusion/traversal	stored creds CVE-2020-25213 CVE-2020-11738 password mutation pivoting/port forwarding ssh_keys directory traversal Duplicator WP plugin
Bank	easy hackthebox unix ctf/realistic paid ubuntu	ssh http dns apache	http dns	file upload fuzzing inspection creds authentication bypass permissions broken access control suid	directory fuzzing extension fuzzing source code inspection stored creds insecure permissions auth bypass via ignore redirect restricted file upload suid custom
Bart	medium hackthebox windows ctf/realistic paid oswe-style	http smb iis php server monitor	http php server monitor	fuzzing bruteforce inspection creds osint routing inclusion/traversal source code review	directory fuzzing log poisoning login bruteforce source code inspection osint-github-repository autologon creds pivoting/port forwarding php source code review
Bashed	easy hackthebox unix ctf free ubuntu	http apache phpbash	http phpbash	command injection fuzzing permissions cron/scheduled tasks sudo/privesc	directory fuzzing command injection cronjob insecure permissions sudo su
Bastard	medium hackthebox windows realistic paid	ssh http rpc iis drupal	http drupal	cve kernel exploit abuse privileges	CVE-2018-7600 SeImpersonatePrivilege MS15-051 CVE-2015-1701
Bastion	easy hackthebox windows realistic paid	ssh http rpc smb winrm netbios	smb netbios	backup/config/system/log file creds mount decrypt	ntlm hash decrypt stored creds vhd mount backup file config file system file mRemoteNG hash decrypt
Beep	easy unix realistic paid ubuntu	ssh http mysql smtp rpcbind https pop imap apache webmin asterisk vtiger crm PBX db server	ssh http smtp https pop imap webmin asterisk vtiger crm PBX	cve kernel exploit creds sudo/privesc inclusion/traversal	lfi CVE-2014-6271 shellshock CVE-2012-4869 sudo chmod sudo nmap dirtycow
Binex	medium tryhackme unix ctf paid ubuntu	ssh smb netbios	ssh smb	cve bruteforce suid path hijacking binary exploitation	rid cycling ssh bruteforce path hijacking suid find CVE-2021-3493 buffer overflow
Biohazard	medium tryhackme unix ctf free ubuntu	ssh http ftp apache vsftpd	ssh http ftp	stego inspection creds decrypt decode sudo/privesc	base58 decode base64 decode binary to ascii image inspection source code inspection stored creds gpg decrypt vigenere decrypt hex decode sudo su stego rot13 decode base32 decode
Black-box Penetration Test 1	easy ine unix windows ctf/realistic free	ssh http rpc smb mssql netbios apache tomcat db server	ssh http rpc	file upload fuzzing bruteforce backup/config/system/log file creds	directory fuzzing login bruteforce default/common creds stored creds backup file unrestricted file upload
Black-box Penetration Test 2	medium ine unix realistic free ubuntu	ssh http mysql dns apache redis ProjectSend db server	ssh http mysql db server	sql injection file upload fuzzing backup/config/system/log file inspection creds code-execution-injection db enumeration decrypt password spraying update file/value	directory fuzzing extension fuzzing mysql-sha1 hash decrypt exposed credentials source code inspection stored creds backup file unrestricted file upload mysql enumeration mysql injection php code execution/injection password spraying via ssh update value via sql query
Black-box Penetration Test 3	easy ine unix ctf free	http ftp apache	http ftp	file upload bruteforce creds routing	default/common creds file upload via ftp ssh bruteforce pivoting/port forwarding
Blaster	easy tryhackme windows realistic free	http rdp wordpress cms iis	http rdp wordpress cms	cve creds	stored creds CVE-2019-1388
Blocky	easy hackthebox unix ctf paid ubuntu	ssh http ftp apache wordpress cms phpmyadmin proftpd	ssh http wordpress cms	fuzzing creds sudo/privesc	directory fuzzing stored creds sudo su
Blog	medium tryhackme unix ctf/realistic free ubuntu	ssh http smb netbios apache wordpress cms	http wordpress cms	cve bruteforce suid	login bruteforce CVE-2019-8942 CVE-2019-8943 suid custom
Blue (HTB)	easy hackthebox windows realistic paid	rpc smb netbios	rpc smb netbios	cve	CVE-2017-0144 eternalblue
Blue (THM)	easy tryhackme windows realistic free	rpc smb netbios rdp	smb netbios	cve	CVE-2017-0144 eternalblue
Blueprint	easy tryhackme windows realistic free	http rpc smb mysql https netbios apache iis osCommerce db server	http osCommerce	code-execution-injection public exploit	php code execution/injection osCommerce exploit
Boats	easy cyberseclabs windows ctf/realistic paid	http rpc smb mysql winrm https netbios rdp wordpress cms phpmyadmin db server	http https wordpress cms phpmyadmin	file upload fuzzing wp plugin exploit inclusion/traversal	directory fuzzing rfi file upload via sql queries TheCartPress WP plugin
Boiler CTF	medium tryhackme unix ctf free ubuntu	ssh http ftp apache joomla cms webmin sar2html vsftpd	ssh http ftp joomla cms sar2html	command injection fuzzing creds decrypt suid public exploit	directory fuzzing rot13 hidden file stored creds suid find sar2html exploit
Bolt	easy tryhackme unix realistic free ubuntu	ssh http apache bolt cms	http bolt cms	authenticated rce creds	stored creds Bolt RCE authenticated
Bookstore	medium tryhackme unix ctf/realistic free ubuntu	ssh http apache werkzeug	http werkzeug	cve fuzzing api backup/config/system/log file inspection two-factor/pin authentication inclusion/traversal reverse engineering	directory fuzzing lfi source code inspection api hacking system file CVE-2021-3493 reverse engineering
Borderlands	hard tryhackme unix realistic free ubuntu	ssh http mysql ftp nginx vsftpd db server bgp	http mysql ftp vsftpd db server bgp	cve sql injection file upload decrypt code reconstruction routing bgp hijacking mobile pentest	dump git repository file upload via sql queries mysql injection vigenere decrypt pivoting/port forwarding bgp hijacking CVE-2011-2523 android static analysis modify routing table
Bounty Hacker	easy tryhackme unix ctf free ubuntu	ssh http ftp apache vsftpd	ssh ftp	bruteforce backup/config/system/log file sudo/privesc	backup file ssh bruteforce sudo tar
Bounty	easy hackthebox windows ctf/realistic paid	http iis	http iis	cve file upload fuzzing abuse privileges	directory fuzzing extension fuzzing restricted file upload SeImpersonatePrivilege CVE-2018-8120
Broker	medium tryhackme unix ctf/realistic free ubuntu	ssh http ActiveMQ	http ActiveMQ	cve file upload creds sudo/privesc	default/common creds CVE-2016-3088 jsp file upload sudo python script
BrooklynNineNine	easy tryhackme unix ctf free ubuntu	ssh http ftp apache vsftpd	ssh http ftp	stego bruteforce backup/config/system/log file inspection sudo/privesc	source code inspection backup file ssh bruteforce stego bruteforce sudo less sudo nano stego
Brute It	easy tryhackme unix ctf free ubuntu	ssh http apache	ssh http	fuzzing bruteforce inspection creds sudo/privesc	directory fuzzing login bruteforce source code inspection sudo cat ssh_keys
Brute	easy cyberseclabs windows ctf/realistic paid active directory osep-style	rpc ldap smb dns kerberos winrm netbios rdp ldaps	kerberos winrm	bruteforce kerberos attack user groups	ASREP Roasting kerberos bruteforce DnsAdmins group
CMS	easy cyberseclabs unix ctf paid ubuntu	ssh http apache wordpress cms	ssh http wordpress cms	creds wp plugin exploit sudo/privesc inclusion/traversal	rfi lfi sudo su ssh_keys WP with Spritz plugin
CMSpit	medium tryhackme unix realistic free ubuntu	ssh http apache cockpit cms mongodb db server	ssh http cockpit cms mongodb db server	cve nosql injection file upload creds broken access control sudo/privesc	stored creds change password CVE-2020-35846 CVE-2020-35847 CVE-2020-35848 unrestricted file upload sudo exiftool CVE-2021-22204
CMesS	medium tryhackme unix ctf/realistic free ubuntu	ssh http apache gila cms	http gila cms	cve file upload fuzzing creds cron/scheduled tasks hidden file wildcard exploit	CVE-2019-17536 exposed credentials hidden file stored creds vhost/subdomain fuzzing cronjob unrestricted file upload tar wildcard
Cap	easy hackthebox unix ctf/realistic paid ubuntu	ssh http ftp gunicorn vsftpd	http	idor inspection creds capabilities	idor stored creds python capabilitie cap_setuid pcap analysis
Carrier	medium hackthebox unix realistic paid ubuntu	ssh http ftp snmp apache bgp	ssh http ftp snmp bgp	creds code-execution-injection udp enumeration routing bgp hijacking	bash execution/injection exposed credentials snmp enumeration bgp hijacking modify routing table
Casino	medium cyberseclabs unix ctf/realistic paid ubuntu	ssh http apache flask	http	ssti ssrf inspection creds sudo/privesc routing	stored creds ssrf ssti pivoting/port forwarding sudo python script git inspection sudo setenv
CatPictures	easy tryhackme unix ctf/realistic free ubuntu	ssh http ftp apache custom app/bot vsftpd phpBB	ssh http ftp custom app	port knock creds permissions cron/scheduled tasks docker escape/privesc	stored creds cronjob insecure permissions docker esc via host cronjob ssh_keys port-knock-open-ftp
Celestial	medium hackthebox unix ctf/realistic paid ubuntu	http express.js node.js	http node.js	deserialization permissions cron/scheduled tasks	node deserialization cronjob insecure permissions
CherryBlossom	hard tryhackme unix ctf free ubuntu	ssh smb netbios	ssh smb	cve stego bruteforce backup/config/system/log file decrypt decode update file/value	base64 decode hexadecimal file modification backup file pkzip hash decrypt sha512 hash decrypt ssh bruteforce stego CVE-2019-18634 CVE-2021-3493 7z hash decrypt
Chill Hack	easy tryhackme unix ctf free ubuntu	ssh http mysql ftp apache vsftpd db server	ssh http mysql ftp db server	sql injection command injection fuzzing stego backup/config/system/log file creds db enumeration decrypt sudo/privesc user groups docker escape/privesc routing	directory fuzzing command injection base64 decode sql injection stored creds backup file mysql enumeration pivoting/port forwarding sudo bash script stego zip hash decrypt docker group
Chocolate Factory	easy tryhackme unix ctf free ubuntu	ssh http ftp apache custom app/bot vsftpd	http	command injection fuzzing creds sudo/privesc	command injection extension fuzzing sudo vi ssh_keys
Chronicle	medium tryhackme unix ctf/realistic free ubuntu	ssh http apache werkzeug	ssh http	fuzzing api backup/config/system/log file inspection creds decrypt binary exploitation	directory fuzzing stored creds config file api hacking api fuzzing git inspection firefox decrypt buffer overflow
Cold VVars	medium tryhackme unix ctf/realistic free ubuntu	http smb netbios apache express.js custom app/bot	http smb custom app	file upload fuzzing creds session hijacking sudo/privesc xpath injection	directory fuzzing extension fuzzing exposed credentials file upload via smb sudo/privesc vim tmux session hijacking xpath injection session hijacking via custom app
Cold	easy cyberseclabs windows ctf/realistic paid	http rpc smb winrm https netbios rdp apache adobe coldfusion	http winrm rdp adobe coldfusion	cve fuzzing creds service escalation	directory fuzzing default/common creds CVE-2018-15961 insecure service permissions
ColddBox	easy tryhackme unix ctf free ubuntu	ssh http apache wordpress cms	http wordpress cms	authenticated rce bruteforce backup/config/system/log file creds sudo/privesc	login bruteforce stored creds config file WordPress RCE authenticated sudo chmod sudo/privesc vim sudo ftp
ContainMe	medium tryhackme unix ctf/realistic free ubuntu	ssh http mysql apache db server	ssh http mysql db server	command injection fuzzing inspection creds db enumeration suid routing	extension fuzzing bash execution/injection default/common creds source code inspection stored creds parameter fuzzing mysql enumeration suid custom pivoting/port forwarding ssh_keys
ConvertMyVideo	easy tryhackme unix realistic free ubuntu	ssh http apache youtube-dl	http youtube-dl	command injection fuzzing decrypt permissions cron/scheduled tasks	directory fuzzing command injection apache md5 hash decrypt cronjob insecure permissions
Cooctus Stories	medium tryhackme unix ctf free ubuntu	ssh http rpcbind nfs werkzeug	ssh http rpcbind nfs werkzeug	cve fuzzing inspection creds code-execution-injection mount decrypt cron/scheduled tasks sudo/privesc gpg keys reverse engineering	directory fuzzing exposed credentials md5 hash decrypt stored creds nfs mount cronjob gpg decrypt git inspection CVE-2021-3493 ssh_keys python execution/injection reverse engineering sudo umount
Couch	easy tryhackme unix ctf/realistic free ubuntu	ssh http apache couchdb db server docker engine api	ssh http apache couchdb db server docker engine api	cve backup/config/system/log file creds db enumeration docker escape/privesc	stored creds couchdb enumeration CVE-2017-12636 log file docker privesc via tcp socket
Cronos	medium hackthebox unix ctf/realistic paid ubuntu	ssh http mysql dns apache laravel framework db server	http mysql dns db server	sql injection command injection authentication bypass permissions dns attack cron/scheduled tasks broken access control	command injection cronjob insecure permissions domain zone transfer auth bypass via sql injection mysql injection
Curling	easy hackthebox unix ctf paid ubuntu	ssh http apache joomla cms	ssh http joomla cms	cve backup/config/system/log file creds decompress	stored creds backup file CVE-2019-7304 decompress tar decompress gz
CyberCrafted	medium tryhackme unix ctf/realistic free ubuntu	ssh http mysql apache db server	ssh http mysql db server	sql injection fuzzing backup/config/system/log file creds code-execution-injection db enumeration decrypt permissions sudo/privesc	extension fuzzing bash execution/injection stored creds vhost/subdomain fuzzing insecure permissions sha1 hash decrypt mysql enumeration log file mysql injection ssh_keys sudo screen
Cyborg	easy tryhackme unix ctf free ubuntu	ssh http apache	http	fuzzing backup/config/system/log file creds decrypt permissions sudo/privesc	directory fuzzing stored creds backup file apache md5 hash decrypt insecure permissions sudo bash script
DailyBugle	hard tryhackme unix realistic free centos	ssh http mysql joomla cms db server	http mysql joomla cms db server	authenticated rce cve sql injection creds db enumeration decrypt sudo/privesc	CVE-2017-8917 bcrypt hash decrypt stored creds mysql injection Joomla RCE authenticated sudo yum
Dav	easy tryhackme unix ctf free ubuntu	http apache webdav	http webdav	file upload creds sudo/privesc	default/common creds file upload via webdav sudo cat
Dave's Blog	hard tryhackme unix ctf free ubuntu	ssh http express.js nginx mongodb db server	http mongodb db server	cve nosql injection code-execution-injection db enumeration decode sudo/privesc binary exploitation	base64 decode nosql injection CVE-2021-3493 sudo custom binary mongodb enumeration node-js execution/injection rop
Debug (CSL)	easy cyberseclabs unix ctf paid ubuntu	ssh http apache flask werkzeug	http werkzeug	fuzzing code-execution-injection decrypt suid	directory fuzzing code execution sha512 hash decrypt suid xxd
Debug (THM)	medium tryhackme unix ctf/realistic free ubuntu oswe-style	ssh http apache	ssh http	deserialization fuzzing backup/config/system/log file inspection creds decrypt permissions hidden file source code review	directory fuzzing hidden file source code inspection stored creds backup file apache md5 hash decrypt insecure permissions php deserialization php source code review
Deja Vu	medium tryhackme unix ctf/realistic free centos	ssh http go web server	http	cve file upload api suid path hijacking	api hacking restricted file upload suid custom path hijacking CVE-2021-22204
Delivery	easy hackthebox unix ctf/realistic paid debian	ssh http mysql nginx Mattermost osTicket db server	ssh http mysql Mattermost osTicket db server	creds db enumeration decrypt software functionality	bcrypt hash decrypt stored creds mysql enumeration software functionality
Deployable	easy cyberseclabs windows ctf/realistic paid	http rpc smb winrm netbios rdp tomcat	http tomcat	file upload creds service escalation	default/common creds unquoted service path
DevOops	medium hackthebox unix ctf paid ubuntu	ssh http gunicorn	ssh http	xxe file upload fuzzing inspection creds	directory fuzzing xxe restricted file upload git inspection ssh_keys
Devel	easy hackthebox windows ctf paid	http ftp iis	http ftp iis	file upload abuse privileges	file upload via ftp SeImpersonatePrivilege
Develpy	medium tryhackme unix ctf free ubuntu	ssh custom app/bot	custom app	command injection permissions cron/scheduled tasks routing shell escape/bypass sandboxes	cronjob insecure permissions pivoting/port forwarding python execution/injection bypass python sandboxes
Dictionary	medium cyberseclabs windows realistic paid active directory osep-style	rpc ldap smb dns kerberos winrm netbios rdp ldaps	rpc smb kerberos winrm netbios	bruteforce creds decrypt password spraying kerberos attack	stored creds password spraying ASREP Roasting kerberos bruteforce smb bruteforce firefox decrypt
Different CTF	hard tryhackme unix ctf free ubuntu	http ftp apache wordpress cms phpmyadmin vsftpd	http ftp wordpress cms phpmyadmin	fuzzing stego bruteforce creds db enumeration decrypt decode suid	directory fuzzing base64 decode stored creds stego bruteforce hex decode suid custom stego su bruteforce base85 decode
Easy Peasy	easy tryhackme unix ctf free ubuntu	ssh http apache nginx	ssh http	fuzzing stego inspection creds decrypt decode permissions cron/scheduled tasks	directory fuzzing base62 decode base64 decode binary to ascii gost hash decrypt image inspection md5 hash decrypt source code inspection cronjob insecure permissions stego
Empline	medium tryhackme unix ctf/realistic free ubuntu	ssh http mysql apache OpenCATS db server	ssh http mysql OpenCATS db server	cve creds db enumeration decrypt capabilities	md5 hash decrypt stored creds CVE-2019-13358 mysql enumeration ruby capabilitie cap_chown
En-pass	medium tryhackme unix ctf free ubuntu	ssh http apache	ssh http	cve fuzzing inspection creds cron/scheduled tasks	directory fuzzing extension fuzzing source code inspection cronjob ssh_keys 403 fuzzing bypass CVE-2020-14343
Engine	easy cyberseclabs windows realistic paid	http rpc smb winrm netbios rdp BlogEngine .NET iis	http winrm rdp BlogEngine .NET	cve file upload fuzzing creds	directory fuzzing CVE-2019-6714 default/common creds autologon creds
Enterprise	hard tryhackme windows realistic free active directory osep-style	http rpc ldap smb dns kerberos winrm netbios rdp iis ldaps	http rpc smb kerberos netbios rdp	fuzzing creds osint decrypt kerberos attack service escalation	kerberoasting krb5tgs hash decrypt stored creds vhost/subdomain fuzzing osint-github-repository unquoted service path
Enterprize	hard tryhackme unix realistic free ubuntu	ssh http nfs apache typo3	http nfs typo3	cve deserialization fuzzing backup/config/system/log file permissions ld.so exploit nfs privesc	extension fuzzing vhost/subdomain fuzzing backup file insecure permissions php deserialization CVE-2020-15099 ld.so exploit nfs no_root_squash
Eternal	easy cyberseclabs windows realistic paid	rpc smb netbios	rpc smb netbios	cve	CVE-2017-0144 eternalblue
Europa	medium hackthebox unix ctf/realistic paid ubuntu	ssh http mysql https apache db server	ssh http mysql https db server	sql injection command injection authentication bypass permissions cron/scheduled tasks public exploit	command injection cronjob insecure permissions auth bypass via sql injection mysql injection preg replace exploit
Explore	easy hackthebox android ctf/realistic paid	ssh ES File Explorer android debug bridge	ssh ES File Explorer android debug bridge	cve inspection creds routing adb	image inspection stored creds CVE-2019-6447 pivoting/port forwarding adb shell
FluxCapacitor	medium hackthebox unix ctf/realistic paid	ssh http https apache	http	command injection fuzzing sudo/privesc	command injection parameter fuzzing sudo bash script
For Business Reasons	hard tryhackme unix realistic free ubuntu	ssh http apache wordpress cms	ssh http wordpress cms	authenticated rce bruteforce creds user groups docker escape/privesc routing	login bruteforce stored creds WordPress RCE authenticated pivoting/port forwarding docker group docker escape lxd group docker unix socket
Fowsniff CTF	easy tryhackme unix ctf free ubuntu	ssh http pop imap apache dovecot	ssh http pop	fuzzing creds osint decrypt permissions user groups	extension fuzzing exposed credentials md5 hash decrypt stored creds insecure permissions osint-pastebin custom group ssh misconfiguration
FriendZone	easy hackthebox unix ctf paid ubuntu	ssh http smb ftp dns https netbios apache vsftpd	ssh http smb dns https netbios	backup/config/system/log file creds dns attack cron/scheduled tasks library hijacking inclusion/traversal	lfi stored creds backup file config file cronjob domain zone transfer library hijacking
Frolic	easy hackthebox unix ctf paid ubuntu	ssh http smb netbios nginx Node-RED playSMS node.js	ssh http playSMS	cve fuzzing inspection creds decrypt decode binary exploitation	directory fuzzing base64 decode exposed credentials source code inspection pkzip hash decrypt Ook! decode brainfuck decode CVE-2017-9101 buffer overflow
Fuel	easy cyberseclabs unix ctf paid ubuntu	ssh http fuel cms nginx	http fuel cms	cve creds	stored creds CVE-2018-16763
Fusion Corp	hard tryhackme windows ctf/realistic free active directory osep-style	http rpc ldap smb dns kerberos winrm netbios rdp iis ldaps	http ldap kerberos winrm	fuzzing backup/config/system/log file inspection creds decrypt kerberos attack abuse privileges user groups	directory fuzzing stored creds backup file ASREP Roasting krb5asrep hash decrypt document inspection SeBackupPrivilege Backup Operators group
GLITCH	easy tryhackme unix ctf/realistic free ubuntu	http express.js nginx	http	fuzzing api inspection code-execution-injection decrypt sudo alternative	directory fuzzing code execution source code inspection parameter fuzzing api hacking firefox decrypt doas all
Gallery	easy tryhackme unix ctf/realistic free ubuntu	http mysql apache db server	http mysql db server	sql injection file upload backup/config/system/log file creds authentication bypass sudo/privesc	stored creds backup file unrestricted file upload auth bypass via sql injection mysql injection sudo nano
Game Zone	easy tryhackme unix realistic paid ubuntu	ssh http mysql apache webmin db server	ssh http mysql webmin db server	cve sql injection creds db enumeration decrypt authentication bypass routing	stored creds mysql enumeration auth bypass via sql injection sha256 hash decrypt mysql injection pivoting/port forwarding CVE-2012-2982
GameBuzz	hard tryhackme unix ctf free ubuntu	ssh http apache	ssh http	deserialization file upload fuzzing port knock creds permissions sudo/privesc	directory fuzzing python deserialization stored creds vhost/subdomain fuzzing restricted file upload sudo bash script port-knock-open-ssh special permissions
GamingServer	easy tryhackme unix ctf free ubuntu	ssh http apache	ssh http	fuzzing inspection creds user groups	directory fuzzing source code inspection lxd group ssh_keys
Ghizer	medium tryhackme unix ctf/realistic free ubuntu	http mysql ftp https wordpress cms db server java-rmi LimeSurvey ghidra jdwp	http LimeSurvey ghidra jdwp	authenticated rce cve deserialization creds permissions sudo/privesc debug program/app	default/common creds insecure permissions php deserialization sudo python script LimeSurvey RCE authenticated CVE-2018-17057 debug program/app
Ghoul	hard hackthebox unix realistic paid ubuntu	ssh http apache tomcat gogs	ssh http gogs	cve fuzzing bruteforce backup/config/system/log file inspection creds session hijacking suid routing public exploit	directory fuzzing extension fuzzing login bruteforce default/common creds stored creds config file pivoting/port forwarding git inspection ssh_keys zipslip exploit CVE-2018-18925 CVE-2018-20303 suid gosu ssh agent hijack
Giddy	medium hackthebox windows realistic paid	http mssql winrm https rdp iis db server PSWA	http mssql winrm https db server PSWA	cve sql injection fuzzing decrypt capture hash/cred/email av evasion service escalation	directory fuzzing netntlmv2 hash decrypt capture ntlm hash insecure service executable mssql injection CVE-2016-6914 av evasion
Git and Crumpets	medium tryhackme unix ctf free ubuntu	ssh http nginx gitea	ssh http gitea	cve inspection creds db enumeration permissions update file/value	image inspection insecure permissions sqlite3 enumeration CVE-2020-14144 update value via sql query ssh_keys
Glass	easy cyberseclabs windows ctf/realistic paid	rpc smb winrm netbios rdp vnc TightVNC	vnc TightVNC	creds registry escalation	default/common creds AlwaysInstallElevated
GoldenEye	medium tryhackme unix ctf free ubuntu	http smtp pop moodle lms dovecot	http pop moodle lms	authenticated rce cve kernel exploit bruteforce inspection creds decode	image inspection source code inspection stored creds html decode pop3 bruteforce Moodle RCE authenticated CVE-2015-1328
Gotta Catch'em All!	easy tryhackme unix ctf free ubuntu	ssh http apache	ssh http	inspection creds sudo/privesc	source code inspection stored creds sudo su
Grandpa	easy hackthebox windows ctf/realistic paid	http webdav iis	http webdav iis	cve file upload	CVE-2017-0144 eternalblue MS17-010 file upload via webdav file upload bypass by rename CVE-2017-7269 MS09-012 MS14-058 MS14-070
Granny	easy hackthebox windows ctf/realistic paid	http webdav iis	http webdav iis	cve file upload	CVE-2017-0144 eternalblue MS17-010 file upload via webdav CVE-2017-7269 MS09-012 MS14-058 MS14-070
HAJokerCTF	medium tryhackme unix ctf/realistic free ubuntu	ssh http apache joomla cms	http joomla cms	authenticated rce cve fuzzing bruteforce backup/config/system/log file creds user groups	directory fuzzing extension fuzzing login bruteforce stored creds backup file Joomla RCE authenticated lxd group CVE-2021-3493
Hack Park	medium tryhackme windows realistic paid	http rdp BlogEngine .NET iis	http BlogEngine .NET	cve bruteforce creds permissions cron/scheduled tasks inclusion/traversal	login bruteforce CVE-2019-6714 insecure permissions scheduled task autologon creds directory traversal
Hamlet	medium tryhackme unix ctf/realistic free ubuntu	ssh http ftp apache custom app/bot lighttpd vsftpd webanno	http ftp webanno	file upload bruteforce backup/config/system/log file decrypt sudo/privesc docker escape/privesc firewall	login bruteforce unrestricted file upload log file sudo cat docker escape via cap_sys_admin docker escape via mount change firewall rules yescrypt hash decrypt
HaskHell	medium tryhackme unix ctf/realistic free ubuntu	ssh http gunicorn	ssh http	file upload creds permissions sudo/privesc	restricted file upload sudo flask run ssh_keys
Hawk	medium hackthebox unix ctf/realistic paid ubuntu	ssh http ftp apache drupal vsftpd H2 Database Engine	ssh http ftp drupal H2 Database Engine	authenticated rce backup/config/system/log file creds decrypt routing shell escape/bypass sandboxes	default/common creds stored creds backup file pivoting/port forwarding bypass python sandboxes decrypt aes256cbc Drupal RCE authenticated H2 Database RCE authenticated
Heist	easy hackthebox windows realistic paid	http rpc smb winrm iis	http rpc smb winrm	bruteforce backup/config/system/log file creds decrypt password spraying process dump packet or dump inspection	stored creds config file cisco type 5 hash decrypt cisco type 7 hash decrypt password spraying rid cycling/brute procdump
Hijack	easy cyberseclabs windows realistic paid	http rpc smb mysql winrm https netbios rdp drupal db server	http drupal	cve abuse privileges service escalation	CVE-2018-7600 SeImpersonatePrivilege dll hijacking
Hip Flask	medium tryhackme unix realistic free ubuntu oswe-style	ssh http dns https nginx flask waitress wsgi	ssh http dns https flask waitress wsgi	cve ssti fuzzing code reconstruction authentication bypass dns attack source code review	directory fuzzing extension fuzzing domain zone transfer ssti auth bypass via cookie forgery CVE-2021-3560 full source code disclosure python source code review
IDE	easy tryhackme unix free ubuntu	ssh http ftp apache codiad vsftpd	http ftp codiad	cve creds sudo/privesc service escalation	CVE-2018-14009 default/common creds stored creds insecure service permissions sudo service
Ice	easy tryhackme windows realistic free	rpc smb netbios rdp Icecast	Icecast	cve kernel exploit	CVE-2004-1561 MS15-051 MS14-058 SeTakeOwnershipPrivilege
Ignite	easy tryhackme unix ctf/realistic free ubuntu	http apache fuel cms	http fuel cms	cve command injection creds	stored creds CVE-2018-16763
Imposter	easy cyberseclabs windows realistic paid	http rpc smb winrm netbios rdp wing ftp server	http ftp wing ftp server	creds code-execution-injection abuse privileges	default/common creds lua code execution/injection SeImpersonatePrivilege
Inclusion	easy tryhackme unix ctf free ubuntu	ssh http werkzeug	http	creds sudo/privesc inclusion/traversal	lfi stored creds sudo socat
Inferno	medium tryhackme unix ctf/realistic free	ssh http apache codiad	http codiad	cve file upload fuzzing bruteforce creds sudo/privesc hidden file	directory fuzzing login bruteforce CVE-2018-14009 hidden file sudo tee
Infovore	easy vulnhub unix ctf/realistic free debian	http apache	http	fuzzing backup/config/system/log file creds hidden file user groups docker escape/privesc inclusion/traversal race condition	extension fuzzing lfi backup file parameter fuzzing docker group docker escape via mount ssh_keys race condition
Internal	hard tryhackme unix ctf/realistic free ubuntu	ssh http apache wordpress cms jenkins	http wordpress cms	authenticated rce fuzzing bruteforce creds routing	directory fuzzing login bruteforce stored creds WordPress RCE authenticated Jenkins RCE authenticated pivoting/port forwarding
Irked	easy hackthebox unix ctf/realistic paid debian	ssh http rpcbind apache UnrealIRCd irc	ssh http UnrealIRCd irc	cve suid	CVE-2010-2075 suid custom
IronCorp	hard tryhackme windows ctf/realistic free	http rpc dns rdp apache iis	http dns	ssrf command injection bruteforce dns attack	command injection login bruteforce domain zone transfer ssrf
JPGChat	easy tryhackme unix ctf free ubuntu	ssh custom app/bot	ssh custom app	code-execution-injection osint sudo/privesc source code review	bash execution/injection osint-github-repository sudo python script sudo setenv python source code review
Jack	hard tryhackme unix ctf/realistic free ubuntu	ssh http apache wordpress cms	ssh http wordpress cms	bruteforce creds permissions wp plugin exploit cron/scheduled tasks user groups library hijacking	login bruteforce cronjob insecure permissions custom group library hijacking ssh_keys
JacobtheBoss	medium tryhackme unix realistic free ubuntu	ssh http mysql rpcbind apache db server jboss	ssh http jboss	cve suid	suid custom CVE-2010-0738
Jason	easy tryhackme unix ctf/realistic free ubuntu	ssh http node.js	http	deserialization sudo/privesc	node deserialization sudo npm
Jeeves	medium hackthebox windows ctf/realistic paid	http rpc smb iis jenkins	http jenkins	authenticated rce fuzzing backup/config/system/log file creds code-execution-injection abuse privileges	directory fuzzing code execution ntlm hash decrypt stored creds backup file Jenkins RCE authenticated SeImpersonatePrivilege
Jeff	hard tryhackme unix ctf/realistic free ubuntu	ssh http wordpress cms nginx	ssh http wordpress cms	fuzzing backup/config/system/log file creds decrypt cron/scheduled tasks sudo/privesc routing sgid shell escape/bypass sandboxes wildcard exploit	directory fuzzing extension fuzzing stored creds vhost/subdomain fuzzing backup file pkzip hash decrypt cronjob pivoting/port forwarding tar wildcard sgid custom sudo crontab
Jerry	easy hackthebox windows ctf/realistic paid	http apache tomcat	http tomcat	file upload creds	default/common creds unrestricted file upload
JurassicPark	hard tryhackme unix ctf/realistic paid ubuntu	ssh http mysql apache db server	ssh http mysql db server	sql injection creds db enumeration sudo/privesc	stored creds mysql enumeration mysql injection sudo scp
Keldagrim	medium tryhackme unix ctf/realistic paid ubuntu	ssh http flask werkzeug	http	broken access control sudo/privesc linux function hooking	ssti cookie/token/field manipulation sudo LD_PRELOAD
Kenobi	easy tryhackme unix ctf/realistic free ubuntu	ssh http smb ftp rpcbind nfs apache proftpd	ssh smb ftp rpcbind netbios nfs proftpd	cve backup/config/system/log file creds mount suid path hijacking	CVE-2015-3306 nfs mount log file suid custom path hijacking ssh_keys
Kiba	easy tryhackme unix ctf/realistic free ubuntu	ssh http apache kibana	http kibana	cve prototype pollution capabilities	CVE-2019-7609 python capabilitie cap_setuid
Knife	easy hackthebox unix ctf/realistic paid ubuntu	ssh http apache	http	code-execution-injection sudo/privesc public exploit	php code execution/injection sudo knife php 8.1.0 dev exploit
Lame	easy hackthebox unix realistic paid ubuntu	ssh smb ftp netbios distcc UnrealIRCd vsftpd irc	smb ftp netbios distcc UnrealIRCd vsftpd irc	cve kernel exploit suid	CVE-2007-2447 CVE-2004-2687 CVE-2010-2075 dirtycow CVE-2008-0166 suid nmap
Lazy	easy cyberseclabs unix realistic paid ubuntu	ssh http smb netbios nginx	smb netbios	cve	CVE-2017-7494
LazyAdmin	easy tryhackme unix ctf free ubuntu	ssh http apache SweetRice	http SweetRice	authenticated rce fuzzing backup/config/system/log file decrypt sudo/privesc	directory fuzzing md5 hash decrypt backup file SweetRice RCE authenticated sudo perl script
Leakage	easy cyberseclabs unix ctf paid ubuntu	ssh http gitlab nginx	ssh http gitlab	creds suid	stored creds suid nano ssh_keys
Legacy	easy hackthebox windows realistic paid	smb netbios	smb netbios	cve	eternalblue CVE-2008-4250 MS08-067 MS17-010
Lian_Yu	easy tryhackme unix ctf free debian	ssh http ftp rpcbind apache vsftpd	ssh http ftp	fuzzing stego inspection creds decode sudo/privesc	directory fuzzing extension fuzzing base58 decode hexadecimal file modification image inspection source code inspection stored creds stego sudo pkexec
Library	easy tryhackme unix ctf free ubuntu	ssh http apache	ssh http	bruteforce sudo/privesc	ssh bruteforce sudo python script symbolic links
Lockdown	medium tryhackme unix ctf/realistic free ubuntu	ssh http mysql apache db server	http mysql db server	sql injection file upload authentication bypass permissions sudo/privesc	insecure permissions unrestricted file upload auth bypass via sql injection mysql injection sudo bash script
Love	easy hackthebox windows ctf/realistic paid	http rpc smb mysql winrm https netbios apache db server	http	authenticated rce ssrf file upload fuzzing creds	directory fuzzing exposed credentials ssrf Voting System RCE authenticated AlwaysInstallElevated
LumberjackTurtle	medium tryhackme unix ctf/realistic free ubuntu	ssh http	http	cve fuzzing docker escape/privesc	directory fuzzing docker escape via mount CVE-2021-44228 log4shell via ldap
Lunizz CTF	medium tryhackme unix ctf free ubuntu	ssh http mysql apache custom app/bot db server	http mysql db server	cve fuzzing backup/config/system/log file misconfiguration creds code-execution-injection db enumeration decrypt update file/value	directory fuzzing extension fuzzing bash execution/injection bcrypt hash decrypt stored creds backup file mysql enumeration update value via sql query CVE-2021-3493 change password via custom app
Madeye Castle	medium tryhackme unix ctf/realistic free ubuntu	ssh http smb netbios apache db server sqlite3	ssh http db server sqlite3	cve sql injection db enumeration decrypt sudo/privesc suid capabilities reverse engineering	sqlite3 enumeration sha512 hash decrypt sqlite3 injection suid custom sudo pico empty capabilitie CVE-2021-3493 reverse engineering
Magician	easy tryhackme unix ctf free ubuntu	http ftp nginx vsftpd ImageMagick	http ImageMagick	cve file upload routing	CVE-2016-3714 pivoting/port forwarding
Mindgames	medium tryhackme unix ctf free ubuntu	ssh http	http	api code-execution-injection decode capabilities	brainfuck decode api hacking cap_setuid python execution/injection openssl capabilitie
Minotaur's Labyrinth	medium tryhackme unix ctf free ubuntu	http mysql ftp https apache proftpd db server	http mysql ftp db server	sql injection command injection creds permissions cron/scheduled tasks	command injection exposed credentials cronjob insecure permissions mysql injection
Mirai	easy hackthebox unix ctf/realistic paid debian	ssh http dns lighttpd pi-hole upnp Plex Media Server	ssh http pi-hole	fuzzing creds sudo/privesc forensic	directory fuzzing default/common creds sudo su forensic
MisguidedGhosts	hard tryhackme unix ctf/realistic free ubuntu	ssh rpc smb ftp https werkzeug vsftpd	ssh smb ftp https	xss command injection port knock backup/config/system/log file inspection creds decrypt session hijacking docker escape/privesc routing	command injection cookie hijacking login bruteforce default/common creds xss backup file log file packet or dump inspection vigenere decrypt pivoting/port forwarding docker escape docker escape via cap_sys_admin tmux session hijacking ssh_keys port-knock-open-https
Mnemonic	medium tryhackme unix ctf free ubuntu	ssh http ftp apache vsftpd	ssh http ftp	fuzzing bruteforce backup/config/system/log file creds osint decrypt decode permissions sudo/privesc	directory fuzzing extension fuzzing base64 decode backup file insecure permissions osint-github-repository ftp bruteforce sudo python script zip hash decrypt ssh_keys mnemonic decrypt
Monitor	easy cyberseclabs windows ctf/realistic paid	http rpc smb winrm netbios rdp PRTG Network Monitor	http smb winrm netbios rdp PRTG Network Monitor	cve backup/config/system/log file creds db enumeration	stored creds backup file sqlite3 enumeration CVE-2018-9276
Mustacchio	easy tryhackme unix ctf free ubuntu	ssh http apache nginx	ssh http	xxe fuzzing backup/config/system/log file inspection creds db enumeration decrypt suid path hijacking	directory fuzzing xxe source code inspection backup file sqlite3 enumeration sha1 hash decrypt suid custom path hijacking ssh_keys
Nax	medium tryhackme unix ctf/realistic free ubuntu	ssh http ldap smtp https apache Nagios XI	http https Nagios XI	cve fuzzing inspection creds decode	extension fuzzing image inspection stored creds number to ascii npiet decode CVE-2019-15949
Netmon	easy hackthebox windows ctf/realistic free	http rpc smb ftp winrm netbios PRTG Network Monitor microsoft ftp	http smb ftp winrm netbios PRTG Network Monitor	cve backup/config/system/log file creds	stored creds backup file CVE-2018-9276
Nibbles	easy hackthebox unix ctf/realistic paid ubuntu	ssh http apache nibbleblog cms	http nibbleblog cms	file upload fuzzing bruteforce sudo/privesc	directory fuzzing extension fuzzing login bruteforce unrestricted file upload sudo bash script
Nineveh	medium hackthebox unix ctf/realistic paid ubuntu	ssh http https apache phpLiteAdmin	ssh http https phpLiteAdmin	file upload fuzzing bruteforce inspection creds code-execution-injection rootkit inclusion/traversal race condition public exploit	directory fuzzing lfi login bruteforce image inspection type juggling file upload via sql queries chkrootkit ssh_keys race condition
Office	easy cyberseclabs unix realistic paid ubuntu	ssh http https apache wordpress cms webmin	ssh http https wordpress cms webmin	cve bruteforce sudo/privesc routing	login bruteforce CVE-2019-15107 pivoting/port forwarding sudo bash
OpenAdmin	easy hackthebox unix ctf/realistic paid ubuntu	ssh http apache OpenNetAdmin	ssh http OpenNetAdmin	command injection fuzzing creds permissions sudo/privesc routing public exploit	directory fuzzing command injection stored creds insecure permissions pivoting/port forwarding sudo nano ssh_keys opennetadmin exploit
Ophiuchi	medium hackthebox unix realistic paid ubuntu	ssh http apache tomcat	http	deserialization backup/config/system/log file creds sudo/privesc	snakeyaml deserialization stored creds config file java deserialization sudo go script
Optimum	easy hackthebox windows realistic paid	http HttpFileServer	http HttpFileServer	cve kernel exploit	CVE-2014-6287 MS16-135
Outdated	easy cyberseclabs unix ctf/realistic paid ubuntu	ssh ftp rpcbind nfs proftpd	ssh ftp rpcbind nfs proftpd	cve kernel exploit creds mount	CVE-2015-3306 nfs mount CVE-2015-1328 ssh_keys
Overpass	easy tryhackme unix ctf free ubuntu	ssh http Go-IPFS	ssh http	inspection creds permissions cron/scheduled tasks broken access control	source code inspection cronjob insecure permissions cookie/token/field manipulation ssh_keys
Passage	medium hackthebox unix realistic paid ubuntu	ssh http apache fail2ban CuteNews	ssh http fail2ban CuteNews	cve file upload creds decrypt usbcreator d-bus	stored creds unrestricted file upload sha256 hash decrypt CVE-2019-11447 usbcreator d-bus ssh_keys
PeakHill	medium tryhackme unix ctf free ubuntu	ssh http ftp custom app/bot vsftpd	ssh ftp	creds decode sudo/privesc	binary to ascii pickle decode stored creds sudo python script decompyle python script pickle encode
PickleRick	easy tryhackme unix ctf ubuntu	ssh http apache	http	command injection creds sudo/privesc	command injection stored creds sudo su
Pie	easy cyberseclabs unix ctf/realistic paid ubuntu	ssh http dns lighttpd pi-hole	http pi-hole	cve	CVE-2020-11108
Pikaboo	hard hackthebox unix ctf/realistic paid debian	ssh http ldap ftp apache nginx vsftpd	http ldap ftp apache nginx	command injection fuzzing misconfiguration creds decode cron/scheduled tasks inclusion/traversal	directory fuzzing lfi log poisoning base64 decode stored creds cronjob nginx misconfiguration perl execution/injection
Pipercoin	hard cyberseclabs unix ctf/realistic paid ubuntu oswe-style	ssh http flask werkzeug	http flask	ssti fuzzing bruteforce creds db enumeration authentication bypass binary exploitation source code review	directory fuzzing stored creds sqlite3 enumeration ssh bruteforce auth bypass via cookie forgery ssti bypass buffer overflow python source code review
Pit	medium hackthebox unix realistic paid centos	ssh http snmp cockpit cms seeddms nginx SELinux	ssh http snmp cockpit cms seeddms SELinux	authenticated rce cve bruteforce backup/config/system/log file creds permissions udp enumeration	login bruteforce stored creds config file insecure permissions snmp enumeration CVE-2019-12744 SeedDMS RCE authenticated
Poison	medium hackthebox unix ctf paid freebsd	ssh http vnc	ssh http vnc	creds decode	base64 decode stored creds vnc pass
Popcorn	medium hackthebox unix realistic paid ubuntu	ssh http apache Torrent Hoster	ssh http Torrent Hoster	cve file upload fuzzing	directory fuzzing restricted file upload dirtycow CVE-2010-0832 CVE-2016-5195
Poster	easy tryhackme unix ctf/realistic free ubuntu	ssh http postgresql apache db server	postgresql db server	command injection bruteforce creds db enumeration sudo/privesc	command injection login bruteforce stored creds postgresql enumeration sudo su
Postman	easy hackthebox unix ctf/realistic paid ubuntu	ssh http apache redis webmin db server	ssh http redis webmin db server	cve file upload backup/config/system/log file creds decrypt	backup file file upload via redis CVE-2019-12840 ssh_keys
Python Playground	hard tryhackme unix ctf free ubuntu	ssh http express.js node.js	ssh http	fuzzing misconfiguration creds code-execution-injection permissions shell escape/bypass sandboxes reverse engineering	extension fuzzing insecure permissions misconfiguration python execution/injection bypass python sandboxes reverse engineering
Ra 2	hard tryhackme windows realistic paid active directory osep-style	http rpc ldap smb dns kerberos https netbios rdp iis ldaps PSWA	dns https PSWA	fuzzing decrypt dns attack cracking capture hash/cred/email abuse privileges	directory fuzzing ntlm hash decrypt capture ntlm hash SeImpersonatePrivilege dns update cracking pkcs12 dns spoofing
Ra	hard tryhackme windows realistic free active directory osep-style	http rpc ldap smb dns winrm netbios rdp ldaps Spark (Ignite Realtime)	http smb winrm netbios Spark (Ignite Realtime)	cve command injection inspection creds decrypt capture hash/cred/email cron/scheduled tasks user groups	command injection exposed credentials image inspection source code inspection change password sensitive data exposure CVE-2020-12772 netntlmv2 hash decrypt capture ntlm hash scheduled task Account Operators group
Racetrack Bank	hard tryhackme unix ctf/realistic free ubuntu	ssh http express.js	http express.js	cve code-execution-injection permissions cron/scheduled tasks race condition	cronjob insecure permissions CVE-2021-3493 node-js execution/injection race condition
RazorBlack	medium tryhackme windows ctf/realistic free active directory	rpc ldap smb dns kerberos winrm rpcbind netbios nfs rdp ldaps	smb kerberos rpcbind netbios nfs	bruteforce backup/config/system/log file misconfiguration creds mount decrypt decode kerberos attack abuse privileges	kerberoasting krb5tgs hash decrypt backup file pkzip hash decrypt password spraying nfs mount ASREP Roasting rid cycling/brute hex decode SeBackupPrivilege Backup Operators group change password via smb/rpc pscredential
Ready	easy hackthebox unix ctf/realistic free ubuntu	ssh http redis gitlab nginx db server	http redis gitlab db server	cve ssrf misconfiguration creds crlf injection docker escape/privesc	CVE-2018-19571 CVE-2018-19585 stored creds docker escape docker escape via cap_sys_admin docker escape via mount
Red	easy cyberseclabs unix ctf/realistic paid ubuntu	ssh http apache redis db server	redis db server	rogue server cron/scheduled tasks	cronjob redis rogue server
Reel	hard hackthebox windows realistic paid active directory osep-style	ssh smtp ftp	ssh smtp ftp	cve backup/config/system/log file inspection creds permissions user groups abuse rights phishing	stored creds backup file change password insecure permissions document inspection custom group control rights phishing via email pscredential CVE-2017-0199 WriteOwner on User WriteDacl on Group
Reel2	hard hackthebox windows realistic paid	http mysql winrm https db server outlook web app wallstant	mysql https db server outlook web app wallstant	file upload fuzzing bruteforce misconfiguration creds decrypt capture hash/cred/email routing shell escape/bypass sandboxes phishing	directory fuzzing login bruteforce stored creds netntlmv2 hash decrypt file upload via sql queries capture ntlm hash pivoting/port forwarding misconfiguration phishing via email StickyNotes PS Constrained Language Escape
Relevant	medium tryhackme windows realistic free	http rpc smb netbios rdp iis	http smb netbios	cve file upload fuzzing abuse privileges	directory fuzzing CVE-2017-0144 eternalblue file upload via smb SeImpersonatePrivilege
Remote	easy hackthebox windows ctf/realistic paid	http rpc smb ftp winrm rpcbind nfs umbraco cms TeamViewer	http smb winrm nfs umbraco cms TeamViewer	authenticated rce creds mount decrypt abuse privileges service escalation	stored creds nfs mount sha1 hash decrypt Umbraco RCE authenticated SeImpersonatePrivilege insecure service permissions teamviewer decrypt
Res	easy tryhackme unix ctf/realistic paid ubuntu	http apache redis db server	http redis db server	file upload sudo/privesc	file upload via redis sudo su sudo xxd
Revenge	medium tryhackme unix realistic free ubuntu	ssh http mysql nginx flask db server	ssh http mysql db server	sql injection fuzzing db enumeration decrypt sudo/privesc service escalation	extension fuzzing bcrypt hash decrypt mysql enumeration mysql injection insecure service permissions sudo systemctl sudo sudoedit
Road	medium tryhackme unix realistic free ubuntu	ssh http mysql nginx mongodb db server	ssh http mysql mongodb db server	file upload inspection creds db enumeration broken access control sudo/privesc user groups linux function hooking	source code inspection stored creds change password unrestricted file upload sudo pkexec mongodb enumeration sudo LD_PRELOAD sudo group
Roast	medium cyberseclabs windows ctf/realistic paid active directory osep-style	rpc ldap smb dns kerberos winrm netbios ldaps	rpc ldap smb kerberos winrm netbios ldaps	creds password spraying kerberos attack abuse rights	kerberoasting exposed credentials password spraying GenericWrite on Group generic rights
Rocket	hard tryhackme unix realistic free ubuntu	ssh http bolt cms express.js mongodb mongo-express rocket.chat db server	ssh http bolt cms mongodb mongo-express rocket.chat db server	cve nosql injection file upload fuzzing backup/config/system/log file creds broken access control capabilities routing	bcrypt hash decrypt stored creds vhost/subdomain fuzzing backup file change password nosql injection CVE-2021-22911 pivoting/port forwarding cap_setuid ruby capabilitie CVE-2019-10758 file upload bypass by change config apparmor restriction
RootMe	easy tryhackme unix ctf free ubuntu	ssh http apache	http	file upload fuzzing sudo/privesc	directory fuzzing restricted file upload sudo python
SafeZone	medium tryhackme unix ctf free ubuntu	ssh http apache	http	command injection fuzzing bruteforce backup/config/system/log file misconfiguration inspection creds sudo/privesc routing inclusion/traversal	command injection extension fuzzing lfi log poisoning login bruteforce exposed credentials source code inspection stored creds backup file homedir-access pivoting/port forwarding sudo python script sudo find
Sam	easy cyberseclabs windows ctf/realistic paid	rpc smb winrm netbios rdp	smb winrm netbios	creds decrypt service escalation	stored creds sam decrypt insecure service executable
Sauna	easy hackthebox windows realistic paid active directory osep-style	http rpc ldap smb dns kerberos winrm netbios iis ldaps	http smb kerberos winrm netbios	creds decrypt kerberos attack abuse rights	ASREP Roasting krb5asrep hash decrypt dcsync autologon creds control rights extended right
Script Kiddie	easy hackthebox unix ctf paid ubuntu	ssh http flask werkzeug	ssh http	cve command injection cron/scheduled tasks sudo/privesc	command injection cronjob CVE-2020-7384 sudo msfconsole
SecNotes	medium hackthebox windows realistic paid	http smb mysql iis db server WSL	http smb mysql db server WSL	sql injection file upload backup/config/system/log file creds csrf	exposed credentials stored creds file upload via smb system file mysql injection csrf
Secret	easy cyberseclabs windows ctf/realistic paid active directory	rpc ldap smb dns kerberos winrm netbios rdp ldaps	rpc smb kerberos winrm netbios	backup/config/system/log file creds password spraying	stored creds backup file password spraying autologon creds
Sense	easy hackthebox unix ctf/realistic paid freebsd	http https lighttpd pfsense	http https pfsense	cve fuzzing backup/config/system/log file creds	extension fuzzing stored creds backup file CVE-2014-4688
ServMon	easy hackthebox unix realistic paid ubuntu	ssh http rpc smb ftp https netbios microsoft ftp TVT NVMS-1000 NSClient++	ssh http ftp https TVT NVMS-1000 NSClient++	cve backup/config/system/log file creds password spraying software functionality inclusion/traversal public exploit	stored creds backup file password spraying CVE-2019-20085 software functionality directory traversal NSClient++ exploit
Set	hard tryhackme windows realistic paid	rpc smb winrm https iis	smb winrm https	cve deserialization fuzzing bruteforce misconfiguration decrypt capture hash/cred/email av evasion	extension fuzzing sensitive data exposure netntlmv2 hash decrypt smb bruteforce capture ntlm hash av evasion CVE-2020-10914 CVE-2020-10915 .NET deserialization
Shaker	hard tryhackme unix realistic free ubuntu	ssh http	ssh http	cve fuzzing user groups routing	directory fuzzing pivoting/port forwarding docker group CVE-2021-44228 log4shell via ldap log4shell via rmi
Shares	easy cyberseclabs unix ctf/realistic free ubuntu	ssh http ftp rpcbind nfs apache	ssh nfs	creds mount sudo/privesc	nfs mount sudo python sudo ssh ssh_keys
Shock	easy cyberseclabs unix ctf/realistic paid ubuntu	ssh http ftp apache vsftpd	http	cve fuzzing sudo/privesc	directory fuzzing extension fuzzing CVE-2014-6271 shellshock sudo socat
Shocker	easy hackthebox unix ctf/realistic paid ubuntu	http apache	http	cve fuzzing sudo/privesc	directory fuzzing extension fuzzing CVE-2014-6271 shellshock sudo perl
Silo	medium hackthebox windows realistic paid	http rpc smb netbios iis oracle tns listener db server	http iis oracle tns listener db server	file upload backup/config/system/log file creds db enumeration abuse privileges packet or dump inspection	default/common creds stored creds packet or dump inspection file upload via sql queries system file SeImpersonatePrivilege oracle enumeration
Simple	easy cyberseclabs unix ctf/realistic paid ubuntu	ssh http mysql apache cms made simple db server	http mysql cms made simple db server	authenticated rce cve sql injection creds db enumeration decrypt suid	CVE-2019-9053 stored creds mysql enumeration CVE-2018-1000094 mysql injection CMS Made Simple RCE authenticated desunix decrypt suid systemctl
Skynet	easy tryhackme unix ctf/realistic paid ubuntu	ssh http smb pop netbios imap apache SquirrelMail cuppa cms	http smb netbios imap SquirrelMail cuppa cms	fuzzing bruteforce backup/config/system/log file creds cron/scheduled tasks inclusion/traversal wildcard exploit public exploit	directory fuzzing rfi login bruteforce stored creds cronjob tar wildcard cuppacms exploit
Smag Grotto	easy tryhackme unix ctf free ubuntu	ssh http apache	ssh http	authenticated rce fuzzing backup/config/system/log file inspection creds permissions cron/scheduled tasks sudo/privesc	directory fuzzing stored creds cronjob insecure permissions log file packet or dump inspection sudo apt-get
SolidState	medium hackthebox unix ctf/realistic paid debian	ssh http smtp pop apache nntp apache james	ssh http smtp pop nntp apache james	misconfiguration creds permissions cron/scheduled tasks public exploit	default/common creds stored creds cronjob insecure permissions change password via custom app apache james server exploit
Source	easy tryhackme unix realistic free ubuntu	ssh http webmin	http webmin	cve	CVE-2019-15107
Spectra	easy hackthebox unix ctf/realistic paid ubuntu chrome os	ssh http mysql wordpress cms nginx db server	ssh http wordpress cms	authenticated rce backup/config/system/log file creds permissions sudo/privesc	stored creds backup file insecure permissions WordPress RCE authenticated sudo setenv sudo initctl
Spray	medium cyberseclabs windows realistic paid active directory osep-style	rpc ldap smb dns kerberos winrm netbios rdp ldaps	rpc smb kerberos winrm netbios	bruteforce backup/config/system/log file creds decrypt password spraying abuse gpo	stored creds backup file password spraying kerberos bruteforce smb bruteforce office hash decrypt abuse-gpo
Stack	easy cyberseclabs windows realistic paid	http rpc smb winrm netbios rdp apache gitstack	http smb winrm netbios rdp gitstack	creds decrypt unauthenticated rce public exploit	default/common creds keepass creds keepass hash decrypt gitstack exploit
Startup	easy tryhackme unix realistic free ubuntu	ssh http ftp apache vsftpd	ssh http ftp	file upload fuzzing inspection creds permissions cron/scheduled tasks	directory fuzzing stored creds file upload via ftp cronjob insecure permissions pcap analysis
Static	hard hackthebox unix ctf/realistic paid debian	ssh http mysql apache db server	ssh http	cve command injection backup/config/system/log file creds two-factor/pin authentication unauthenticated rce path hijacking capabilities routing public exploit	default/common creds backup file path hijacking pivoting/port forwarding cap_setuid modify routing table add static route totp xdebug exploit CVE-2019-11043 custom binary capabilitie
SteelMountain	easy tryhackme windows realistic paid	http rpc smb winrm netbios rdp iis HttpFileServer	http HttpFileServer	cve service escalation	CVE-2014-6287 unquoted service path
Stratosphere	medium hackthebox unix ctf/realistic paid ubuntu	ssh http mysql apache db server	ssh http mysql apache db server	cve fuzzing creds db enumeration sudo/privesc shell escape/bypass sandboxes	directory fuzzing stored creds mysql enumeration sudo python script bypass python sandboxes CVE-2017-5638
StuxCTF	medium tryhackme unix ctf/realistic free ubuntu	ssh http apache	http	deserialization inspection decode sudo/privesc cryptography inclusion/traversal source code review	rfi lfi base64 decode source code inspection php deserialization hex decode sudo su cryptographic challenge php source code review
Super-Spam	medium tryhackme unix ctf free ubuntu	ssh http ftp apache vnc concrete cms TightVNC	ssh http ftp vnc concrete cms TightVNC	file upload bruteforce backup/config/system/log file inspection creds decrypt decode cracking	login bruteforce stored creds backup file unrestricted file upload log file packet or dump inspection cracking wifi password xor decrypt rot13 decode
Sustah	medium tryhackme unix ctf/realistic free ubuntu	ssh http apache gunicorn mara cms	http mara cms	authenticated rce fuzzing backup/config/system/log file creds hidden file sudo alternative	default/common creds hidden file backup file custom fuzzing MaraCMS RCE authenticated doas rsync
SwagShop	easy hackthebox unix ctf/realistic paid ubuntu	ssh http apache magento cms	http magento cms	authenticated rce cve sudo/privesc public exploit	CVE-2015-1397 CVE-2015-1398 CVE-2015-1399 Froghopper exploit Magento RCE authenticated sudo vi
Sweettooth Inc.	medium tryhackme unix ctf/realistic free debian	ssh rpcbind db server influxdb docker engine api	ssh db server influxdb docker engine api	cve api creds db enumeration authentication bypass broken access control docker escape/privesc routing	stored creds api hacking cookie/token/field manipulation pivoting/port forwarding docker escape via mount CVE-2019-20933 influxdb enumeration docker privesc via tcp socket
Sync	medium cyberseclabs windows realistic paid active directory osep-style	rpc ldap smb dns kerberos winrm netbios rdp ldaps	rpc smb kerberos winrm netbios	bruteforce kerberos attack capture hash/cred/email abuse rights	ASREP Roasting kerberos bruteforce capture ntlm hash dcsync control rights extended right GenericWrite on User
TartarSauce	medium hackthebox unix realistic paid ubuntu	http apache wordpress cms	http wordpress cms	cve fuzzing inspection wp plugin exploit cron/scheduled tasks sudo/privesc inclusion/traversal	directory fuzzing rfi source code inspection cronjob sudo tar CVE-2015-8351 Gwolle Guestbook WP plugin
Teacher	easy hackthebox unix ctf/realistic paid ubuntu	http mysql apache moodle lms db server	http mysql moodle lms db server	cve misconfiguration inspection creds db enumeration decrypt cron/scheduled tasks	image inspection md5 hash decrypt source code inspection stored creds cronjob insecure permissions CVE-2018-1133 mysql enumeration
Team	easy tryhackme unix ctf/realistic free ubuntu	ssh http ftp apache vsftpd	http ftp	fuzzing creds permissions cron/scheduled tasks sudo/privesc inclusion/traversal	directory fuzzing extension fuzzing lfi stored creds vhost/subdomain fuzzing cronjob insecure permissions sudo bash script ssh_keys
Temple	hard tryhackme unix realistic paid ubuntu	ssh http ftp apache flask werkzeug vsftpd telnet logstash	http flask logstash	ssti fuzzing misconfiguration permissions	directory fuzzing insecure permissions ssti bypass misconfiguration
Tempus Fugit 1	medium vulnhub unix ctf/realistic free debian	ssh http ftp dns apache vsftpd getsimple cms	http ftp dns getsimple cms	authenticated rce file upload command injection fuzzing creds dns attack capture hash/cred/email sudo/privesc routing	directory fuzzing bash execution/injection stored creds domain zone transfer capture credentials pivoting/port forwarding GetSimple RCE authenticated mdns poisoning sudo dmesg
Tempus Fugit 2	medium tryhackme unix realistic free ubuntu	ssh http smtp apache wordpress cms	ssh http smtp wordpress cms	authenticated rce port knock bruteforce misconfiguration inspection creds dns attack capture hash/cred/email sudo/privesc	stored creds change password ssh bruteforce WordPress RCE authenticated port-knock-open-ssh misconfiguration network inspection dns spoofing capture email sudo timedatectl sudo docker exec
Tempus Fugit Durius	hard tryhackme unix realistic paid debian	ssh http ftp dns rpcbind nginx flask vsftpd batflat cms	ssh http ftp dns batflat cms	authenticated rce command injection backup/config/system/log file creds db enumeration dns attack routing sgid	bash execution/injection stored creds sqlite3 enumeration domain zone transfer log file pivoting/port forwarding Batflat RCE authenticated sgid ispell
TenTen	medium hackthebox unix ctf/realistic paid ubuntu	ssh http mysql apache wordpress cms db server	ssh http wordpress cms	cve idor stego creds wp plugin exploit sudo/privesc user groups	idor CVE-2015-6668 sudo bash script stego lxd group ssh_keys job-manager WP plugin
The Great Escape	medium tryhackme unix realistic free ubuntu	http docker engine api endlessh	http docker engine api	ssrf command injection fuzzing port knock backup/config/system/log file inspection docker escape/privesc	directory fuzzing extension fuzzing bash execution/injection backup file ssrf git inspection port-knock-open-docker-engine-api docker escape via tcp socket
The Marketplace	medium tryhackme unix realistic free ubuntu	ssh http mysql express.js nginx node.js db server	http mysql db server	sql injection xss creds db enumeration session hijacking sudo/privesc user groups docker escape/privesc wildcard exploit	cookie hijacking stored creds xss mysql injection sudo bash script docker group tar wildcard docker escape
TheServerFromHell	medium tryhackme unix ctf free ubuntu	ssh rpcbind nfs custom app/bot	ssh rpcbind nfs custom app	backup/config/system/log file mount decrypt capabilities shell escape/bypass sandboxes	backup file pkzip hash decrypt ssh_keys cap_dac_read_search tar capabilitie
Thompson	easy tryhackme unix ctf free ubuntu	ssh http apache tomcat	http tomcat	file upload creds permissions cron/scheduled tasks	default/common creds cronjob insecure permissions
Toast	hard cyberseclabs windows realistic paid active directory osep-style	rpc ldap smb dns kerberos netbios rdp ldaps	rpc ldap smb kerberos netbios ldaps	file upload bruteforce creds kerberos attack cron/scheduled tasks av evasion abuse privileges service escalation	exposed credentials ASREP Roasting rid cycling file upload via smb scheduled task amsi bypass SeImpersonatePrivilege insecure service permissions unquoted service path
Tokyo Ghoul	medium tryhackme unix ctf free ubuntu	ssh http ftp apache vsftpd	ssh http ftp	fuzzing stego backup/config/system/log file creds decrypt decode sudo/privesc inclusion/traversal	directory fuzzing lfi base64 decode stored creds backup file sha512 hash decrypt morse code decode hex decode sudo python script stego
Traceback	easy hackthebox unix ctf paid ubuntu	ssh http apache	ssh http	fuzzing creds osint permissions sudo/privesc	extension fuzzing default/common creds insecure permissions osint-github-repository sudo luvit ssh misconfiguration
Traverxec	easy hackthebox unix ctf/realistic paid debian	ssh http nostromo	ssh http nostromo	cve backup/config/system/log file misconfiguration decrypt sudo/privesc	CVE-2019-16278 md5 hash decrypt backup file homedir-access ssh_keys sudo journalctl
UltraTech	medium tryhackme unix realistic free ubuntu	ssh http ftp apache express.js node.js vsftpd	ssh http	command injection fuzzing api backup/config/system/log file decrypt user groups docker escape/privesc	directory fuzzing bash execution/injection md5 hash decrypt backup file parameter fuzzing api hacking docker group docker escape
Unattended	easy cyberseclabs windows ctf/realistic paid	http rpc smb winrm netbios rdp HttpFileServer	http HttpFileServer	cve creds	CVE-2014-6287 unattended installation file
UnbakedPie	medium tryhackme unix ctf/realistic free ubuntu	http django	http django	deserialization bruteforce sudo/privesc routing library hijacking	python deserialization ssh bruteforce pivoting/port forwarding sudo python script library hijacking
Undiscovered	medium tryhackme unix ctf/realistic free ubuntu	ssh http rpcbind nfs apache RiteCMS	ssh http nfs RiteCMS	cve fuzzing bruteforce mount suid capabilities reverse engineering	directory fuzzing login bruteforce vhost/subdomain fuzzing nfs mount CVE-2020-23934 suid custom cap_setuid vim capabilitie reverse engineering
Unroot	easy cyberseclabs unix ctf paid ubuntu	ssh http apache phpmyadmin	http	cve command injection fuzzing	directory fuzzing command injection CVE-2019-14287
Unstable Twin	medium tryhackme unix ctf/realistic free centos	ssh http nginx flask db server sqlite3	ssh http db server sqlite3	sql injection fuzzing api stego creds db enumeration decrypt	stored creds sqlite3 enumeration sha512 hash decrypt api hacking sqlite3 injection api fuzzing stego
Uranium CTF	hard tryhackme unix ctf/realistic free ubuntu	ssh http smtp apache custom app/bot	http smtp custom app	backup/config/system/log file misconfiguration inspection creds osint sudo/privesc suid phishing	stored creds log file suid nano sudo bash pcap analysis misconfiguration osint-twitter-account phishing via email suid dd
Valentine	easy hackthebox unix ctf paid ubuntu	ssh http https apache	ssh http https	cve fuzzing backup/config/system/log file creds session hijacking	directory fuzzing backup file CVE-2014-0160 heartbleed tmux session hijacking ssh_keys
Validation	easy hackthebox unix ctf paid ubuntu	ssh http mysql apache nginx db server	http mysql db server	sql injection file upload creds	stored creds file upload via sql queries mysql injection
VulnNet	medium tryhackme unix realistic free ubuntu	ssh http apache clipbucket	ssh http apache clipbucket	file upload fuzzing backup/config/system/log file inspection creds decrypt cron/scheduled tasks inclusion/traversal wildcard exploit public exploit	lfi source code inspection stored creds vhost/subdomain fuzzing backup file parameter fuzzing config file apache md5 hash decrypt cronjob tar wildcard ssh_keys clipbucket exploit
VulnNet: Active	medium tryhackme windows realistic free active directory osep-style	rpc smb dns netbios redis db server	rpc smb netbios redis db server	cve decrypt permissions capture hash/cred/email cron/scheduled tasks abuse gpo	insecure permissions netntlmv2 hash decrypt capture ntlm hash scheduled task PrintNightmare abuse-gpo CVE-2021-1675 CVE-2021-34527
VulnNet: Internal	easy tryhackme unix realistic free ubuntu	ssh smb rpcbind netbios nfs rsync redis TeamCity db server	ssh smb rpcbind netbios nfs rsync redis TeamCity db server	backup/config/system/log file misconfiguration creds db enumeration mount software functionality routing	stored creds config file nfs mount file upload via rsync software functionality pivoting/port forwarding redis enumeration
VulnNet: Node	easy tryhackme unix realistic free ubuntu	http express.js node.js	http node.js	deserialization sudo/privesc	node deserialization sudo npm sudo systemctl
VulnNet: Roasted	easy tryhackme windows ctf/realistic paid active directory	rpc ldap smb dns kerberos winrm netbios ldaps	rpc smb kerberos winrm netbios	bruteforce backup/config/system/log file creds decrypt kerberos attack	stored creds backup file ASREP Roasting krb5asrep hash decrypt rid cycling/brute
VulnNet: dotjar	medium tryhackme unix ctf/realistic free ubuntu	http apache tomcat	http tomcat	cve file upload fuzzing backup/config/system/log file creds decrypt sudo/privesc	directory fuzzing stored creds backup file sha512 hash decrypt CVE-2020-1938 sudo java file
VulnNet: dotpy	medium tryhackme unix ctf/realistic free ubuntu	http werkzeug	http	ssti sudo/privesc	ssti ssti bypass sudo python script sudo setenv sudo pip3
Vulnversity	easy tryhackme unix realistic free ubuntu	ssh http smb ftp http proxy netbios apache squid proxy	http	file upload fuzzing suid	directory fuzzing restricted file upload suid systemctl
WWBuddy	medium tryhackme unix ctf/realistic free ubuntu	ssh http mysql apache db server	http mysql db server	sql injection log poisoning fuzzing bruteforce backup/config/system/log file creds broken access control suid reverse engineering	directory fuzzing log poisoning stored creds change password ssh bruteforce log file mysql injection suid custom reverse engineering
Waldo	medium hackthebox unix ctf/realistic paid debian	ssh http nginx	ssh http	creds capabilities docker escape/privesc inclusion/traversal source code review	ssh_keys cap_dac_read_search tar capabilitie directory traversal path traversal docker escape via ssh php source code review
Watcher	medium tryhackme unix ctf free ubuntu	ssh http ftp apache vsftpd	http ftp	file upload creds cron/scheduled tasks sudo/privesc library hijacking inclusion/traversal	lfi file upload via ftp cronjob sudo su sudo python script library hijacking ssh_keys
Weak	easy cyberseclabs windows ctf/realistic paid	http rpc smb ftp netbios rdp iis microsoft ftp	http ftp	file upload abuse privileges	file upload via ftp SeImpersonatePrivilege
Wekor	medium tryhackme unix ctf/realistic free ubuntu	ssh http mysql apache wordpress cms Memcache db server	ssh http mysql wordpress cms Memcache db server	authenticated rce sql injection fuzzing creds db enumeration decrypt permissions sudo/privesc path hijacking routing	directory fuzzing stored creds vhost/subdomain fuzzing wordpress hash decrypt insecure permissions mysql enumeration mysql injection WordPress RCE authenticated path hijacking pivoting/port forwarding sudo custom binary
Wgel	easy tryhackme unix ctf free ubuntu	ssh http apache	ssh http	fuzzing backup/config/system/log file inspection sudo/privesc	directory fuzzing source code inspection ssh_keys sudo wget
Wreath	easy tryhackme unix windows realistic free centos osep-style	ssh http rpc smb winrm https apache webmin gitstack	ssh http smb winrm webmin gitstack	cve file upload inspection creds decrypt abuse privileges routing service escalation firewall	ntlm hash decrypt stored creds alternative php file upload CVE-2019-15107 SeImpersonatePrivilege pivoting/port forwarding git inspection unquoted service path change firewall rules
Writeup	easy hackthebox unix ctf/realistic paid debian	ssh http mysql cms made simple db server	ssh http mysql cms made simple db server	cve sql injection fuzzing db enumeration decrypt cron/scheduled tasks path hijacking user groups	directory fuzzing CVE-2019-9053 md5 hash with salt decrypt cronjob mysql enumeration mysql injection path hijacking ssh misconfiguration staff group
Year Of The Dog	hard tryhackme unix ctf/realistic free ubuntu	ssh http mysql apache gitea db server	http mysql gitea db server	cve sql injection file upload backup/config/system/log file misconfiguration creds two-factor/pin authentication sudo/privesc routing	stored creds CVE-2020-14144 log file file upload via sql queries mysql injection sqli via cookie pivoting/port forwarding sudo su misconfiguration bypass two-factor
Year Of The Fox	hard tryhackme unix ctf free ubuntu	http smb netbios apache	http smb netbios	command injection bruteforce sudo/privesc path hijacking routing	command injection login bruteforce ssh bruteforce path hijacking pivoting/port forwarding sudo shutdown
Year Of The Jellyfish	hard tryhackme unix realistic free ubuntu	ssh http ftp https apache vsftpd Monitorr	http https Monitorr	cve file upload	unrestricted file upload CVE-2020-28871 CVE-2019-7304
Year Of The Owl	hard tryhackme windows ctf/realistic free	http smb mysql winrm https netbios rdp snmp apache db server	smb winrm netbios rdp snmp	backup/config/system/log file password spraying udp enumeration	backup file password spraying snmp enumeration system file
Year Of The Pig	hard tryhackme unix ctf/realistic free ubuntu	ssh http apache	ssh http	bruteforce creds db enumeration decrypt permissions sudo/privesc	login bruteforce md5 hash decrypt stored creds insecure permissions sqlite3 enumeration sudo sudoedit
Year Of The Rabbit	easy tryhackme unix ctf free debian	ssh http ftp apache vsftpd	ssh http ftp	cve fuzzing bruteforce inspection creds decode	directory fuzzing image inspection source code inspection stored creds brainfuck decode ftp bruteforce CVE-2019-14287
Zeno	medium tryhackme unix ctf/realistic free centos	ssh http mysql apache restaurant manager system db server	ssh http restaurant manager system	file upload fuzzing creds unauthenticated rce permissions sudo/privesc public exploit	directory fuzzing stored creds insecure permissions unrestricted file upload sudo reboot rms exploit
Zero	easy cyberseclabs windows realistic paid active directory	rpc ldap smb dns winrm netbios rdp	rpc smb netbios	cve	CVE-2020-1472
battery	medium tryhackme unix ctf free ubuntu	ssh http apache	ssh http	xxe fuzzing backup/config/system/log file creds authentication bypass permissions broken access control sudo/privesc	extension fuzzing xxe stored creds backup file insecure permissions auth bypass via sql truncation sudo python script
dogcat	medium hackthebox unix ctf/realistic paid ubuntu	ssh http dns apache No-IP	ssh http dns No-IP	command injection api backup/config/system/log file creds dns attack sudo/privesc wildcard exploit	bash execution/injection exposed credentials log file api hacking sudo bash script ssh_keys dynamic dns dns update cp wildcard
envizon	hard tryhackme unix realistic free ubuntu oswe-style	ssh https custom app/bot	ssh https custom app	file upload command injection idor fuzzing api backup/config/system/log file creds cron/scheduled tasks predictable hash calculation source code review	command injection idor backup file config file cronjob unrestricted file upload api hacking api fuzzing ssh_keys predictable hash calculation ruby source code review
hackerNote	medium tryhackme unix realistic free ubuntu	ssh http	http	cve bruteforce misconfiguration creds	login bruteforce exposed credentials CVE-2019-18634
harder	medium tryhackme unix realistic free ubuntu oswe-style	ssh http nginx	ssh http	backup/config/system/log file misconfiguration creds code reconstruction restriction suid encrypt gpg keys source code review	stored creds backup file dump git repository bypass via ip origin suid custom gpg keys encrypt gpg php source code review
hc0n Christmas CTF	hard tryhackme unix ctf free ubuntu	ssh http mysql apache db server	ssh http	cve fuzzing backup/config/system/log file creds decrypt session hijacking binary exploitation padding oracle mobile pentest	directory fuzzing cookie hijacking stored creds backup file CVE-2021-3493 buffer overflow padding oracle aes decrypt android static analysis
pyLon	medium tryhackme unix ctf free ubuntu	ssh custom app/bot	ssh custom app	stego inspection creds decode sudo/privesc gpg keys	base64 decode default/common creds image inspection stored creds gpg decrypt git inspection stego ssh_keys sudo openvpn/privesc via conf
No binary matches...

VVBL
Star

Features

Attributes

VVBL Star

Features

Attributes

VVBL
Star